Although it was ruled out that it was a cyber attack, in April 2025 Spain and Portugal suffered a massive electric blackout that activated the response mechanisms nationwide. These centers coordinate the response to incidents in strategic sectors such as energy, transport, banking, health and telecommunications.
In Guatemala, at this time there is no response center with international standards, although at the moment a package of three law initiatives that seek to accelerate the regulations that pursue the online scammers and the cybercriminals that attack nationwide are worked.
“We cannot have committed critical infrastructures,” says Jorge Mario Villagrán, deputy president of the National Security Affairs Commission of the Congress of the Republic during a forum transmitted by Guatevisión within the alliance with Guatemala does not stop.
The concern of the expert panel focused on that in Guatemala there is no uniform regulatory framework that forces hospitals, power plants, water networks or air traffic control to adopt minimum cybersecurity standards.
“Today nobody defends us, because we do not have a regulatory framework that makes us pursue cyberdelites … very soon we will have a legal framework in which we can work for cybercrime protection,” says Villagrán.
Particularly referred to the initiative package that includes 6347, Cybersecurity Law; that related to critical infrastructure, and data protection. All are waiting for an opinion to start their way in the legislative plenary.
In the forum, broadcast on June 2 by Guatevisión – and available on YouTube -, Amílcar de León, a private cybersecurity expert, and María Zaghi, marketer of Campustec and representative of the Technology Observatory, also participated. The conversation was moderated by the journalist Guillermo Velarde.
See here the complete forum:
https://www.youtube.com/watch?v=7vgoa9Ke33Y
Proposals include specific points that could change the way Guatemala defends cybercriminals.
A Critical Infrastructure Catalog
According to De León, “in Guatemala we do not have a list of what a critical infrastructure is or what are, for example, the financial sector, the sugar company, the coffee grower.” However, he added that units such as the National Civil Police, the Public Ministry or the National Institute of Forensic Sciences (INACIF) have created specialized dependencies before the increase in incidents.
Meanwhile, experts advocated Guatemala, for the first time, with clear rules and a coordinated system to protect their most vital services from cyber threats.
This law would lay the legal basis to create an official catalog of critical infrastructure, define and classify what type of facilities and systems should be included and identified concrete assets that, if committed, would put the country in check. In addition, it would establish methods and criteria to evaluate risks and vulnerabilities of each element.
“We have the example of the Xayá-Pixcayá archaeological site, which in 2023 suffered an attack, and Chixoy hydroelectric plant, which has been the target of attempts. We cannot have committed critical infrastructures,” Villagrán complements.
He adds that each ministry should prepare a catalog of what its critical assets consider. “The law contemplates that these catalogs will not be public to prevent cybercriminals from having access to information.”
His vision is that cameras must also point out what their critical companies are. “We must be very careful with that part because you can believe that you are trying to invade private property, but it is not so,” he says.
In addition to rivers, subsoils or mineral deposits, which can be considered as natural critical infrastructures, in Guatemala others such as hospitals, bridges, airports, roads, ports, customs, fuel deposits and hydroelectric plants have been identified in Guatemala, which each organ of the Executive should categorize institutionally.
An incident response center
For Zaghi, at this stage of discussion it is important to coordinate what calls an “inclusive governance” and “decentralized”, perhaps supported by technologies such as blockchain.
According to Villagrán, the Law contemplates the foundation of a Secretariat of Critical Infrastructure within the National Security Council, with autonomy to coordinate all the actors involved in the cybersecurity strategy.
“Annually more than 360 billion attempts of attacks only in Latin America are recorded, according to De León. Here we are talking only about Guatemala. How many of these become effective? There is a deficit of professionals of more than 4 million in the world. So, it is not just a matter of saying that there is a law or not.”
In this context, the panelists also agreed on the need to create institutionality around cybersecurity and cyber -defense. First, with the Autonomous Secretariat mentioned by Villagrán, and secondly, with what is known in English as an incident response center, or CSirt (Computer Security Incident Response Team).
According to a definition requested by the Free Press to the Villagrán Communication Team, this center “will have the powers to direct and coordinate the response to computer security incidents with public and private institutions; these are related to the cybersecurity and cyber -defense of the state of Guatemala.”
“The problem we have is where we are going to place it – the response center – because governance is a very important part of the security system not only national, but of all Guatemala,” says Villagrán.
The proposal must establish the institutionality, principles and general regulations that will allow structuring, regulating and coordinating the cybersecurity actions of the different state and individual agencies.
De León contributes that “Spain has seven specialized CSirt; (but) our goal must be, first, to have a robust and then decentralize CSIRT.” For Villagrán, the response center must also be autonomous, with public-private participation and “without politicization”.
Defined cyberdelites
“Where we had a little more delay was in the cyberdelites, which required a lot of work on how to typify them. The law will be a bit hard when it comes to penalties, and prevent them from being one of those that you leave prison with a payment, because if not the judges are going to go for the easiest,” he reports.
De León complements that there are in the Criminal Code “a few articles that do not talk about cybercrime or cybersecurity, but it is what we have today.” For example, he adds, “extortion is a crime that is already typified, only today we have executed it with digital tools, which already creates the new cyberextorsion term.”
The UN Convention against Cyber crime establishes at least a dozen new cybercriminals, ranging from theft or fraud related to a technology system to the non -consented dissemination of intimate images or computer falsification. The list is continued by violations such as instigation for sexual purposes against minors or the illicit interception of non -public data transmitted through various technologies.
“Those behind the attack are not in Guatemala, and that complicates the situation greatly because, unlike a conventional crime, where we have a homicidal weapon in a crime scene, here we do not know in which part of the world you can find the person behind the computer making the attack.”
According to the Villagrán communication team, the revision of most points referring to the Cybersecurity Law initiative was already completed, with the exception of the cyber -governance and governance section. They estimate that, in a month, the opinion of the law would be counted, however, they point out that this could be delayed for reasons of agenda and meetings.
International cooperation
The Leon expert is emphatic that Guatemala needs international support. “There is no country that can independently with an attack where we are talking about four, five, six countries join with an army of cybercriminals to attack a victim.”
In this regard, Villagrán reported that Guatemala renewed his subscription to the Budapest agreement on April 12 and has three more years to align.
The Budapest agreement is an instrument that includes minimum international standards and international law regulations related to the cybersecurity issue.
“Public-private and international cooperation is key (Budapest Agreement). Without local regulation we cannot formalize a CSirt or make the agreement effective,” adds León.
At the same time, the socialization of the mentioned initiatives and their process for opinion is pending.
Find more than Guatemala does not stop In our video channels of Free press and Guatevisión, An alliance content Focused on journalism of solutions.